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ABSTRACT 

This paper describes the progression of the Safehold mode design on the Solar Dynamics Observatory 
satellite. Safehold uses coarse Sun sensors and reaction wheel tachometers to keep the spacecraft in a 
thermally safe and power-positive attitude. The control algorithm is described, and simulation results 
shown. Specific control issues arose when the spacecraft entered eclipse, and a description of the trade study 
which added gyroscopes to the mode is included. The paper concludes with the results from the linear and 
nonlinear stability analysis. 

SDO OVERVIEW 

The Solar Dynamics Observatory (SDO) is a geosynchronous satellite that is part of the Living With 
a Star Program. SDO remains Sun-pointing during its mission in order for the instruments to take mea- 
surements of the Sun. The spacecraft launches into a Geosynchronous Transfer Orbit (GTO), and then 
circularizes into a Geosynchronous Orbit (GEO). 

There are six control modes on SDO: Science, Inertial, Sun Acquisition, Delta-H, Delta-V, and Safehold. 
During Science mode, the spacecraft has a stringent pointing accuracy requirement, and the science instru- 
ments take measurements of the Sun. Calibrations and slews are performed during Inertial mode, and Sun 
Acquisition mode is used to acquire the Sun after tipoff or during a recovery from large slews. Delta-H and 
Delta-V are both thruster modes. Delta-H unloads momentum built up in the reaction wheels, and Delta-V 
provides orbit-changing burns. The attitude sensor suite on SDO includes 16 coarse Sun sensors (CSS), a 
digital Sun sensor, three two-axis inertial reference units (IRU), two star trackers, and four guide telescopes. 
The actuators include four reaction wheels (RWA), eight attitude thrusters, and a single main engine, (ref. 
1 ) 

SAFEHOLD MODE 

The purpose of the Safehold mode is to keep the spacecraft in a thermally safe and power-positive attitude 
in the event of a failure. Safehold is located on the attitude control electronics (ACE) processor on SDO, 
while the other control modes are located on the main processor, which houses the attitude control system 
(ACS) software. Since the mode is on a separate processor, there is protection against a main processor 
failure. 

In order to have a robust Safehold, the mode is as simple as possible, while still meeting all requirements. 
Safehold is similar to the Sun Acquisition mode. 

Safehold Requirements 

Safehold is required to keep the spacecraft in a safe orientation if the mode is entered due to any kind 
of failure on the spacecraft. To ensure that SDO remains in a power-positive orientation, the Safehold mode 
has the requirement to acquire and maintain an attitude placing the Sun to within 15° of the vector normal 
to the solar arrays. This acquisition must occur within 30 minutes of mode entry or eclipse exit, and from 
any initial attitude. 

The Safehold mode is required to have the ability to acquire the Sun-pointing attitude while holding 
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the tip off separation rates, which may be as high as [0.5, 0.6, 0.6] °/sec, or equivalent to a momentum of 41 
Nms. Additionally, Safehold must be capable of storing two orbits of momentum build-up in GTO due to 
environmental disturbances, which is equal to 5.6 Nms. Nominally, the spacecraft will unload momentum 
after each GTO orbit, but the two orbit requirement allows for an extra orbit of stored momentum in the 
case of a missed maneuver. In GEO, the spacecraft must survive Safehold with five weeks of momentum 
build-up, estimated to be 37 Nms. 

All Safehold requirements must be met using only three reaction wheels. If the spacecraft is settled 
before entering eclipse, Safehold must ensure that the attitude is within 45° of the Sun upon eclipse exit. 

In order to meet all requirements, the Safehold control mode has a commanded position with the Sun 
normal to the solar arrays. A zero commanded rate nulls the rates on all three axes. Control is performed 
indefinitely, and Safehold mode flies directly off of the processed sensor measurements, rather than by 
determining an attitude. A Proportional-Derivative (PD) controller is used. 

Sensor Suite Selection 


Safehold is required to be extremely reliable. For this reason, it is desired to make Safehold as simple 
as possible by using a low number of sensors, all of which have a low probability of failure. 

One Safehold sensor used on SDO is the array of CSSs, which is used to detect the Sun direction. There 
are sixteen CSSs on SDO, arranged in two sets of eight sensors each, mounted in pairs for redundancy. There 
are two sets of CSSs at each mounted location of the spacecraft, with one set tied to ACE A, and the other 
to ACE B. The sensors are mounted on the outer tip corners of the solar panels on the +x and -x sides in 
order to avoid as much blockage as possible. The locations of the eight CSS pairs are shown in Figure 1, 
with the sensors on the -x side of the spacecraft shown in parentheses. 


CSS 3 

(CSS 7 ) 




CSS 2 

(CSS 6 ) 



css 4 

(CSSs) 


CSSi 

(CSS 5 ) 



Figure 1: CSS Layout (Not to Scale) 

The CSS boresights point away from the spacecraft to minimize blockage. Both the top and bottom 
sets are evenly spaced, with 90° between each sensor boresight in the yz plane, and 45° between each sensor 
and the closest y or z axis. The top set of sensors is rotated 45° out of plane towards the +x axis, while 
the bottom set is rotated an equal amount towards the — x axis. Opposite sensors (such as CSSi and CSS 7 ) 
point in opposite directions along the same axis. 

The Sun vector is calculated from the CSS measurements by taking the difference of opposing CSSs and 
rotating the resulting vector into the spacecraft body frame. This method is shown in Equation 1. 
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S]3cs — f^Css2Bcs 


( 1 ) 


CSSi - css 7 

CSS 2 - CSSs 
CSS Z - CSSs 
CSSa - CSSs 

where s Bcs is the Sun vector in the spacecraft body frame, R>css2Bcs is a 4x3 matrix representing the 
rotation from the CSS frame to the spacecraft body frame, and CSS n is the CSS measurement from the 
corresponding sensor. 

The spacecraft rate is required as a second measurement to the controller. Two options for obtaining 
the rate were examined: using the gyro, or deriving the rates from the CSS sensors. The tradeoffs between 
control algorithm complexity, reliability, and momentum capability were explored. 

Safehold With a Gyro 

One option for a rate source is to use the IRU, or gyro. A direct spacecraft rate can be obtained in 
three axes. A gyro is favorable in Safehold because it provides an accurate measurement of the rate, even 
around the roll axis. In addition, the sensor suite is identical to the Sun Acquisition mode, and therefore 
the control algorithm is the same and has a second layer of testing. From analysis, it was determined that 
including a gyro in the Safehold algorithm allowed for a greater envelope in momentum buildup. However, 
including the IRU does not offer the spacecraft the minimum possible hardware set for Safehold. There are 
also no modes that work independent of the IRU, which can cause problems if the original fault that causes 
entrance into Safehold is in the gyro. However, the control algorithm is less complex if a gyro is included. 

Gyroless Safehold 

Instead of using a gyro to obtain spacecraft rates, an alternate method is to derive the rate by looking 
at the change in CSS measurements over time. A gyroless Safehold mode is beneficial because it allows for a 
minimum hardware set. Also, there is protection if a gyro failure causes a transition to Safehold. However, 
rates derived from the CSSs are not as accurate as direct measurements from the gyro, and the rate along 
the sunline can not be calculated using CSSs only. With a less accurate rate, the system observability is 
lessened, and the capability of the mode is decreased. In addition, the rate can not be derived during eclipse 
because the CSSs do not receive a measurement. However, in the environment of low external torques, it 
can be shown that rates about the sunline can be derived using wheel information. 

After weighing the options of Safehold with a gyro and gyroless Safehold, the decision was made to use 
CSS-derived rates with reaction wheel sunline rate derivation because of the lower hardware set and the 
capability of a gyroless mode on SDO. 

Development of Gyroless Safehold Mode 

The development of the Safehold mode began with a simple PD controller, as shown in Equation 2 

T = K p d + K d e (2) 

where T is the control torque, K p is the proportional gain, I Q is the derivative gain, 6 is the attitude error, 
and 0 is the rate error. 

Attitude Error Calculation 

The attitude error is calculated by taking the cross product of the unit Sun vector calculated from the 
CSS measurements, designated here as s, and the desired unit Sun vector, s<f, as in Equation 3. 
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In Safehold mode, 


s d 


1 

0 
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such that the spacecraft x-axis is pointing towards the Sun. 


( 4 ) 


When the spacecraft x-axis is close to Sun-pointing, which is the desired target, the attitude error 
approaches zero. However, a zero error is also calculated when the spacecraft is in a ‘flipped’ orientation, 
or rotated 180° from desired. This error is. due to the nature of the cross product, which does not take 
polarity into account. If the spacecraft x-axis is exactly 180° from the Sun, and the spacecraft rate is zero, 
it is possible that SDO could become ‘stuck’ in that orientation until environmental disturbance torques 
increased enough to push it from its backwards point. 

Additional ‘flip logic’ is implemented in the attitude error calculation to avoid an attitude error of zero 
for a 180° flip. If 6 X < Tolfu p , where Tolfu p is a tolerance, a small artificial attitude error is added so that 
the spacecraft is pushed from its equilibrium point. 


Rate Error Calculation 


A simple rate error is calculated using Equation 5 

9 = s x s (5) 


where 6 is the spacecraft rate and s is the rate of the Sun in the body frame derived from the CSSs. 

Two methods were examined to calculate the actual rate around the x-axis. Both methods use the 
characteristics of the momentum in the reaction wheels to calculate the rate. The full control laws for these 
controllers are described below. 

Triana Method - The Triana Method (ref. 2) was developed for use on the Triana spacecraft. This 
method uses the idea that in steady state, the component of system momentum in the spacecraft yz plane 
rotates with a rate that is approximately equal to the angular rate of the the spacecraft x-axis. The wheel 
momentum in the body frame, H^,, tracks close to the system momentem in the yz plane. Therefore, is 
valid for an estimation of the rate along the x-axis. 


The Triana Method is described below in Equations 6 through 9. 

Ti = KpLimit (0) + x (6) 

where 

0 = s x s d (7) 

T 2 = K w [(Ti x H w ) • s d ] Sd (8) 

and 

T w = T 1 + T 2 (9) 

Here, K w is a scalar gain applied on the sunline rate estimation, Ti and T 2 are components of the wheel 
control torque, T w , and other values are defined above. 

The Sun angle error from the Triana Method controller is shown in Figure 2. The dashed line at 15° 
represents the error angle requirement, and the dashed line at time equal to 1800 seconds represents the 30 
minute acquisition limit. The spacecraft begins 180° from Sun-pointing, and then acquires the Sun. 


Sunline Method - A second method to calculate spacecraft rate about the sunline was developed inde- 
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Sun Angle vs Time, Triana Method 



Figure 2: Sun Angle Error Using the Triana Method Controller 


momentum in the plane perpendicular to the sunline. Since system momentum is constant except for the 
effects of small environmental disturbances, the spacecraft rate can be derived by following the change in 
wheel momentum in the body frame. This method can be used to calculate a rate in the x-axis when the 
spacecraft is close to its pointing target. In this orientation, the sunline axis is approximately x, and the 
perpendicular plane is approximately yz . 

The projection of wheel momentum on the yz body plane, H Wj;s , is plotted for timestep £fc, and the 
previous step of tk-i in Figure 3. The spacecraft rate estimate in the x direction, u) x , is in the opposite 
direction of e, the angle of change of wheel momentum. 

YZbCS 



Figure 3: Change in Wheel Momentum in the Y Z Spacecraft Body Frame 
The relation of spacecraft rate and change in wheel momentum is shown in Equation 10. 
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( 10 ) 
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The angle of momentum vector change is calculated by 


For a small A t, assume: 


sin(£) 


||H Wyx (tfc_l) X H tt r yz (tfc)|| 

| H. Wyz (tk- 1 ) | 


( 11 ) 


||H w> .(t*)|| = ||Hu, y ,(tfc_i)|| = y/H Wv (t k )*+H WM (t k )* 

and sin(e) ~ e. Therefore, 


H Wy [t k - 1 ) • H w ,{tk) - H Wt (t k - 1 ) ■ H Wy (t k ) 
H^itk) 2 + H Wl (t k )* 


Combining this result with Equation 10 leads to a spacecraft rate in the s-axis direction of 


(12) 


(13) 


_ _ Hwytyk) 1 HwJtk- 1 ) ~ HwAtk) • HwJ^k-i) /. 

(H Wv (tk) 2 + H Wz (tk) 2 ) At 

When the spacecraft is close to its target (Sun in the x-axis direction) , the x component of rate derived from 
the CSS is replaced with Cj x , and the calculation of 0 in Equation 5 is replaced with Equation 15. 
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where K perp is the gain on the portion of the rate error perpendicular to the sunline, and K sun u ne is the 
gain on the sunline axis rate. 


The commanded wheel torque using the sunline method is 


( (■- .\ T 

‘ 0 

0 

0 " 

{ Kperp * ( S X S J 

0 

1 

0 

V v ' 

0 

0 

1 


K sunline * 


leading to a commanded body torque of 


T& — T w 


(16) 

(17) 


This equation is not valid when the components of momentum in the y and z-axes, H Wy and H Wz , 
approach zero. In this instance, the majority of the wheel momentum is located along the sunline, and 
therefore can not provide an observable rate. When this occurs, the sunline rate is zeroed out to avoid error 
due to noise. 


The Sun angle error results from a simulation of the sunline method are shown in Figure 4. As in Figure 
2, the dashed lines represent the 15° and 30 minute requirements. 

The sunline controller was chosen over the Triana controller for implementation on SDO. Monte Carlo 
simulation runs of both methods showed that the sunline controller was able to handle a greater range of 
initial momentum conditions, particularly along the x-axis. A filter was included on the rate in order to 
reduce the effect of differentiation of hardware noise from the measurements. 
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Time (sec) 

Figure 4: Sun Angle Error Using the Sunline Method Controller 


SAFEHOLD DURING ECLIPSE 

SDO experiences two eclipse seasons per year. During that time, eclipse lengths reach a maximum of 
72 minutes. As mentioned previously, Safehold must ensure that the +x-axis is no more than 45° from the 
sunline upon exit from every eclipse. This requirement exists in order to minimize the electrostatic discharge 
upon reentry into sunlight. The eclipse requirement is not enforced if the control mode is not settled before 
entry into the Safehold mode, or if Safehold is entered during eclipse 

During eclipse, the CSSs are not able to detect any light, and therefore are not able to calculate a Sun 
position vector. With the only attitude sensor unavailable, the spacecraft experiences an uncontrolled drift. 
In order to meet the eclipse requirement, it is necessary to control the drift without using the Sun. An initial 
idea for for eclipse control was a wheel speed controller. 

Eclipse Wheel Speed Controller 

If a spacecraft is holding a constant attitude and has no rates, all of its momentum exists in the reaction 
wheels and no momentum is in the body. Since system momentum is constant, the wheel momentum and 
wheel rates are constant. The wheel speed controller was developed to use a proportional controller to hold 
the wheel speeds constant. 

When the wheel speed controller was implemented in Safehold mode, it was determined that the 45° 
eclipse requirement is not always met. Figure 5 shows a case where the angle between the x-axis and the 
sunline reaches 45°. Here, the dashed lines designate the start and end of the eclipse period, as well as the 
45° requirement. 

The spacecraft true body rate is shown in Figure 6, and the wheel rates are shown in Figure 7. Here, 
it can be noted that the controller is working as designed, since the wheel rates are being held constant. 
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Figure 5: Sun Angle Error During Eclipse with Wheel Speed Controller 


However, the logic behind the controller design is flawed since the drift is not being suppressed. 

The flaw in the controller exists because of the assumption that the body rates are zero when the 
spacecraft holds a constant attitude. In fact, a small amount of residual rate is left in the body upon eclipse 
entry because of the nature of the PD controller as well as noise in the system. This residual rate means 
that some of the system momentum is located in the body, instead of all being held in the wheels. When 
the wheels are held constant, it allows the spacecraft to drift from target pointing. Over the timespan of the 
eclipse, the spacecraft undergoes a drift which puts it outside the requirement range. 

Since the 45° requirement was not met for all possible initial conditions, a trade study was developed to 
examine alternate ways to limit the drift during eclipse. 

Safehold Eclipse Trade Study 

In the trade study to meet the eclipse drift requirement, three options were studied and compared. These 
options were modifying the baseline design, adding the gyro to night mode, and adding the gyro to the entire 
Safehold mode. 

Option 1: Modify Baseline 

The first option considered to solve the eclipse issue was to modify the baseline wheel speed controller 
in order to retain the gyroless Safehold. The dynamics of the system were examined with the hope that a 
full understanding of the system equations of motion would reveal a method for controlling the drift. Upon 
examination, it was discovered that the system dynamics are very complex, and the benefits gained from 
studying the system may not be enough to solve the problem within a reasonable amount of project time. 

The focus of the baseline modification shifted to the limiting cases of eclinse drift. Tt. was discovered 
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Spacecraft Rate vs Time, Wheel Speed Controller 



Figure 6: True Spacecraft Rates During Eclipse with 
Wheel Speed Controller 


Wheel Tach vs Time, Wheel Speed Controller 
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Figure 7: Wheel Rates During Eclipse with Wheel 
Speed Controller 


that when the momentum direction was close to the x-axis, or the majority of the rates were in the x-axis, 
large drifts occurred. However, the main cause of momentum build-up on the spacecraft is the solar pressure 
torque, which has a large component in the spacecraft body z-axis, and a smaller component in the y-axis. 
Because of the spacecraft geometry, it is unlikely that the component of x-axis momentum would be the 
largest, and therefore the large drifts should be avoided. The SDO analysis team considered setting up a 
Delta-H mode that would ensure that a good momentum state was obtained at the end of the unload. 

Further study revealed that there are certain cases that can lead to the maximum momentum to be 
located along the x-axis. As SDO remains Sun-pointing, it rotates once per year about its z-axis. Since 
unloading is scheduled to occur once per month, the spacecraft will rotate 30° in this time, and therefore a 
portion of the y-axis momentum will then be located in the x direction. If this rotation causes an increase 
in momentum build-up in the x-axis, problems may occur. Additionally, there may be a problem if Safehold 
eclipse is entered immediately after an unload. The Delta-H mode unloads all wheels down to near zero, but 
if the x-axis is a little higher, Safehold eclipse may experience a drift. 

The method of filtering the measured data was examined with the hopes that a good filter would reduce 
the rate error during sunlight, and therefore lead to a smaller drift during eclipse. Instead, it was determined 
that using a higher order filter succeeded in reducing the hang-off of the steady-state pointing error, but the 
rate upon entry to eclipse was not smaller, leading to no significant change to the magnitude of the drift 
during eclipse. 

Option 2: Safehold Eclipse with Gyros 

The second option considered was to include gyros in the eclipse portion of Safehold. This action makes 
the Safehold eclipse mode identical to the Sun Acquisition eclipse mode. Adding the gyro means that SDO 
no longer has a purely gyroless mode. However, since SDO is in an inclined GEO orbit, the spacecraft is, in 
sunlight for approximately 97.3% of the mission, and therefore only requires a gyro for a small percentage 
of its lifetime. 

Figure 8 shows the Sun angle error when a gyro is used during eclipse periods with the same initial 
conditions as Figure 5. The amount of drift during eclipse is reduced, and does not come close to exceeding 
the 45° requirement limit. 

Adding the gyro to the baseline Safehold has little impact on the ACS analysis workload because of the 
similarities with, the Sun Acquisition mode. There ie an increase m Snftwarp workload sinrp thp TRTT 
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Sun Angle vs Time, IRU during eclipse 



Figure 8: Sun Angle Error Using Gyros During Eclipse 


processing did not exist on the baseline ACE. 

Option 3: Safehold with Gyros 

The final Safehold eclipse option studied was to add gyros to the entire Safehold mode. Here, all of the 
mode is identical to Sun Acquisition. Since the gyro is the sole rate source, the gyro is required at all times 
on the spacecraft. 

The resulting Sun angle error from this simulation run is shown in Figure 9. 

As in Figure 8, the amount of drift during eclipse is greatly reduced. Using a gyro for the entire Safehold 
mode leads to a slightly smaller total drift than if the gyro is only used during eclipse. This result occurs 
because the pointing error entering eclipse is smaller when the IRU is used as the rate source instead of a 
derivation from the CSS and RWA, however the difference is almost negligible. 

As in the second option, adding the gyro to the baseline does not have much impact on the ACS analysis 
workload since Safehold becomes identical to Sun Acquisition. The Flight Software workload increases in 
order to add the IRU processing in the ACE. 

FINAL SDO SAFEHOLD MODE DESIGN 

After looking at the results from the trade study, the decision was made to include the gyros in Safehold 
eclipse. There was not a large difference in the amount of drift when the gyros were included in eclipse 
only versus using gyros for the entire Safehold. However, there is a large benefit in having a mode that is 
primarily gyroless in the event that there is a gyro problem during the mission. 

The final Safehold design is separated into day and night sections. During the day, a PD controller 
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Sun Angle vs Time, IRU during Safehold 
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Figure 9: Sun Angle Error Using Gyros During Safehold 


is implemented in Safehold. CSSs are used to calculate the attitude error and the rate error in the y and 
z pointing directions. When the spacecraft is close to Sun-pointing, the RWA tachometers are used to 
calculate the rate error in the x, or sunline, direction. The controller is provided in Equation 16. In eclipse, 
a Derivative controller is used with IRU rates to control the system. 

The final design provides for a mode which is gyroless for a large majority of the mission, but uses the 
IRU when necessary to meet requirements during eclipse. 

STABILITY MARGIN ANALYSIS 

A stability margin analysis was performed on the system to ensure that the closed- loop system met 
the margin requirements and the system was robust against phase and gain uncertainties. Both linear and 
nonlinear analyses were examined. 

The phase margin requirement is > 30°, and the gain margin requirement is > 6 dB. In addition, a 
modal suppression of 12 dB is required to reduce the flexible mode response. 

Linear Analysis 

The linear analysis of the controller includes the first three flexible modes in the spacecraft dynamics, 
as well as hardware dynamics. A one control cycle delay is modelled as a first-order Pade approximation, 
and a low-pass filter on the rate is included to reduce sensor noise. 

Figure 10 is a block diagram of the linear stability analysis for the day portion of Safehold. 
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Figure 10: Linear Stability, Safehold Day Mode 


The low-pass filter, Gf(s) is first-order and equal to 


G f (s) = 



where r equals 0.5305. The hardware dynamics are assumed to be 


(18) 


Gcss{s) = 1 


(19) 


for the CSS and 

for the reaction wheels, where oj w 
the loop at the X. 


G w (s) = 


S + OJ u 


( 20 ) 


is equal to 10Hz. There is a single, loop gain analysis performed by cutting 


Figure 11 shows the linear stability analysis block diagram for the night portion of Safehold. 
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Figure 11: Linear Stability, Safehold Night Mode 

In night mode, there are two control loops because of the addition of the gyro. However, since k p is 
equal to zero, the outer loop, designated in the figure by a dashed line, is ignored. The analysis is performed 
by cutting the loop at the X. 
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The gyro dynamics are assumed to be 




S ^ T 2(^i0gS 4* 


( 21 ) 


where the natural frequency, oj gy is equal to 7 Hz and the damping ratio, £, is 0.707. 


The results from the linear stability analysis in Safehold are presented in the form of a Nichols chart in 
Figure 12, with the day mode in Figure 12(a) and the night mode in Figure 12(b). 



(a) Day Mode 


(b) Night Mode 


Figure 12: Safehold Stability Analysis Nichols Diagrams 


The phase margin, gain margin, bandwidth, and modal suppression from analysis on each axis are shown 
in Table 1. 


Table 1: Stability Margins for Safehold 


Mode 

Axis 

Phase Margin 
degrees 

Gain Margin 
dB 

Bandwidth 

Hz 

Suppression 

dB 

Day 

X 

78.2 

33.5 

0.020 

38 

y 

58.8 

32.3 

0.028 

41 

z 

58.8 

32.3 

0.028 

41 

Night 

X 

31.7 

13.5 

0.170 

22 

y 

31.7 

13.5 

0.170 

22 

z 

31.7 

13.5 

0.170 

22 


The stability analysis shows that the phase and gain margin requirements, as well as the modal suppres- 
sions, are met and lead to a robust system. The night mode has smaller margins because the controller is 
rate only. The responses for the x-axis during the day mode are different than the y and z-axes because the 
controller is different along that axis. 

The values for the night portion of the closed-loop bandwidth are larger than the day mode bandwidth 
because of performance requirements. The rate-only controller needs to have a faster response so that the 
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drift during eclipse is suppressed. This response is accomplished by increasing the rate gain, leading to a 
higher bandwidth. 


Nonlinear Analysis 


Lyapunov stability theory was applied in an attempt to prove global, asymptotic stability for the SDO 
Safehold controller. Of particular interest, and difficulty, was the development of a valid scalar Lyapunov 
function that included the sunline rate controller. Equation 22 yielded the most useful results. 


y = -i«.w + jir p .(i-a x )>o 


for all non-zero u? and s x < 1 


( 22 ) 


where I is the spacecraft moment of inertia, w is the true spacecraft rate, and s x represents the x-component 
of the unit Sun vector in the spacecraft body frame. When the Sun is perfectly acquired, I* = 1, and 
otherwise < 1. The derivative of this function is: 

v = iu>-u-K p J x <o (23) 


which must be shown to be true for all non-zero c o and s x . If the control torque on the body from Equations 
16 and 17 is set equal to the body derivative of the angular momentum, the result provides an expression to 
substitute for the right-hand side of Equation 23. 
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• u) 


It is helpful to note that another way of writing Q is 


(24) 


HIM 2 


(25) 


Substituting for uj x in Equation 24 using Equation 25 and carrying out the dot product with u> leads to: 

V = — KdS • s - K dx K sunline (u x 2 ) - K dx K sunline oj x Hwz ^ v zH . 2 — (26) 


To prove global stability, it must be shown that: 


V <0 V s,u;^0 

V = 0 only if s, u; = 0 


(27) 


The first two terms of Equation 26 are clearly negative except at equilibrium on the sunline. The last 
term, which deals with the sunline rate control, can be proven negative if conditions of the following forms 
are met: 


1. Wheel momentum perpendicular to the x-axis is sufficiently large: ||#u> y J| > Hmi n . 

2. The perpendicular components of body rates should be less than w x : yw y 2 4- u) 2 < u x . 

3. If uj x is very small, there is no need to control it: uj x > w x>m * n . 

To determine values for these conditions that meet the strict Lyapunov criterion is possible, but the 
values and their implementation is a complication that is really unnecessary and therefore undesirable. 
Instead, it is recognized that, by keeping the sunline rate gains much lower than the transverse axis gains, 
the third term in Equation 26 must have a magnitude that is very small compared to the first and second 
terms in all cases, except when the spacecraft is safely pointed at the Sun. Even then, as long as RWA 
tachometer noise does not cause the sunline rate estimate to have the opposite sign from the true rate, the 
value should be negative 
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CONCLUSION 


The Safehold mode on SDO uses CSSs and RWAs, along with a PD controller, to keep the spacecraft in 
a power-positive and thermally safe orientation. A position error is calculated from the CSS measurements, 
and the rate error is derived from the CSS in the y and z body directions and derived from the RWA in the 
x direction when certain conditions are met. During eclipse, a derivative controller is used with the IRU for 
rate-only control. 

A stability margin analysis on the Safehold mode proves that the system meets margin requirements 
and is robust against phase and gain uncertainties. 
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